I have seen many write-ups on "malware research", what information are they trying to gather?

Is it the origins of the malware? Or its behavior patterns? Or something else?


Whodunit, what it does, what vulnerability it exploits, what it's communicating with (if anything), how it spreads, if it contains any useful forensic indicators etc etc.

Like watching a mutating biological virus and working out how it acts and how to develop a vaccine, the purpose of reverse engineering malware is to work out what it's doing and why.

There's a lot you can tell from such an analysis. What servers is it talking to, for example? This will pin down a compromised server at the minimum, and possibly a control server for a botnet at best. Knowing where the control server is might lead you to the individual or group responsible, or at least give you an idea.

Likewise, analysing the malware binary will possibly reveal previously unknown exploits. It'll also show you how malware authors are attempting to evade detection and what their goals are - for example, if the malware copies all word documents to a remote server, well, you now know they're after documents of some kind.

Origin can be given away. It's at least reasonably well known that Microsoft compilers embed program debug database paths in the output of the executable if you don't tell them not to; from the language used in said path you might be able to gather where the malware originated from, or even the intent. If the user who wrote it happened to develop it in c:\users\name\... well then you even know who they are!

In short, analysing malware is about finding out what you can about the infection - anything that might help identify the culprit, or further detection/prevention of future infections.


Short answer : find what it does (interactions with the infected system : files creation, keylogging, password stealing etc.).

This can be used to get a pattern used later by an AV product (malware signature). It can be used to trace back the author, too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.